ISO 27002 Control 8.33: Key Security Considerations for Test Data
While non-production test environments such as staging environments are essential to building high-quality software products and applications free of bugs or errors, the use of real data and lack of security measures in these environments expose information assets to heightened risks.
For example, developers may use easy-to-remember credentials(e.g “admin” for both username and password) for testing environments in which sensitive data assets are stored.
This may be exploited by cyber attackers to gain easy access to test environments and steal sensitive information assets.
Therefore, organisations should put in place appropriate controls and procedures to protect real-world data used for testing.
Purpose of Control 8.33
Control 8.33 enables organisations to achieve two purposes:
- To protect and maintain the confidentiality of information used in the testing environment.
- Selection and use of test information that will yield reliable results.
Attributes Table of Control 8.33
Control 8.33 is a preventive type of control that requires organisations to select and protect the most appropriate information for the testing stage so as to maintain the confidentiality and integrity of information.
| Control Type | Information Security Properties | Cybersecurity Concepts | Operational Capabilities | Security Domains |
|---|---|---|---|---|
| #Preventive | #Confidentiality | #Protect | #Information Protection | #Protection |
| #Integrity |
ISO 27001 made easy
An 81% Headstart from day one
We’ve done the hard work for you, giving you an 81% Headstart from the moment you log on. All you have to do is fill in the blanks.
Ownership of Control 8.33
Considering that Control 8.33 entails the selection, protection, and management of the most appropriate test information to be used for testing, information security officers, in cooperation with the development team, should be ultimately responsible for establishing appropriate controls and procedures.
General Guidance on Compliance
Organisations should not use sensitive information, including personal data, in the development and testing environments.
To protect the test information against loss of confidentiality and integrity, organisations should comply with the following:
- Access controls applied in real-world environments should also be implemented in test environments.
- Establishing and implementing a separate authorisation procedure for the copying of real information into test environments.
- To keep an audit trail, all activities related to copying and use of sensitive information in test environments should be recorded.
- If sensitive information will be used in the test environment, it should be protected with appropriate controls such as data masking or data removal.
- Once the testing is completed, information used in the test environment should be safely and permanently removed to eliminate the risk of unauthorised access.
Furthermore, organisations should apply appropriate measures to ensure the secure storage of information assets.
Supplementary Guidance on Control 8.33
It is noted that system and acceptance testing may require an enormous amount of test information, equivalent to operational information.
Manage all your compliance, all in one place
ISMS.online supports over 100 standards and regulations, giving you a single platform for all your compliance needs.
Changes and Differences from ISO 27002:2013
27002:2022/8.33 replaces 27002:2013/(14.3.1)
Although the 2022 version is similar to the 2013 version to great extent, the 2022 Version introduces the following requirement:
- If sensitive information will be used in the test environment, it should be protected with appropriate controls such as data masking or data removal.
The 27002:2013 version, in contrast, did not include this requirement.
New ISO 27002 Controls
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 5.7 | NEW | Threat intelligence |
| 5.23 | NEW | Information security for use of cloud services |
| 5.30 | NEW | ICT readiness for business continuity |
| 7.4 | NEW | Physical security monitoring |
| 8.9 | NEW | Configuration management |
| 8.10 | NEW | Information deletion |
| 8.11 | NEW | Data masking |
| 8.12 | NEW | Data leakage prevention |
| 8.16 | NEW | Monitoring activities |
| 8.23 | NEW | Web filtering |
| 8.28 | NEW | Secure coding |
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 6.1 | 07.1.1 | Screening |
| 6.2 | 07.1.2 | Terms and conditions of employment |
| 6.3 | 07.2.2 | Information security awareness, education and training |
| 6.4 | 07.2.3 | Disciplinary process |
| 6.5 | 07.3.1 | Responsibilities after termination or change of employment |
| 6.6 | 13.2.4 | Confidentiality or non-disclosure agreements |
| 6.7 | 06.2.2 | Remote working |
| 6.8 | 16.1.2, 16.1.3 | Information security event reporting |
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 7.1 | 11.1.1 | Physical security perimeters |
| 7.2 | 11.1.2, 11.1.6 | Physical entry |
| 7.3 | 11.1.3 | Securing offices, rooms and facilities |
| 7.4 | NEW | Physical security monitoring |
| 7.5 | 11.1.4 | Protecting against physical and environmental threats |
| 7.6 | 11.1.5 | Working in secure areas |
| 7.7 | 11.2.9 | Clear desk and clear screen |
| 7.8 | 11.2.1 | Equipment siting and protection |
| 7.9 | 11.2.6 | Security of assets off-premises |
| 7.10 | 08.3.1, 08.3.2, 08.3.3, 11.2.5 | Storage media |
| 7.11 | 11.2.2 | Supporting utilities |
| 7.12 | 11.2.3 | Cabling security |
| 7.13 | 11.2.4 | Equipment maintenance |
| 7.14 | 11.2.7 | Secure disposal or re-use of equipment |
How ISMS.online Helps
ISMS.online is a cloud-based solution that helps companies show compliance with ISO 27002. The ISMS.online solution can be used to manage the requirements of ISO 27002 and ensure that your organisation remains compliant with the new standard.
The ISO 27002 standard has been updated to reflect the growing cyber threats we face as a society. The current standard was first published in 2005 and revised in 2013 to reflect changes in technology, regulations and industry standards. The new version of ISO 27002 incorporates these updates into one document, as well as adding new requirements for organisations to help them better protect their data assets from cyber attacks.
The ISMS.online solution helps organisations implement ISO 27002: 2022 by providing an easy-to-use framework for documenting information security policies and procedures. It also provides a centralised location where you can store all your compliance documentation so it can be easily accessed by different stakeholders in the company (e.g. HR, IT).
Our platform is user-friendly and straightforward. It is not only for highly technical individuals; it is for everyone in your company.
Get in touch today to book a demo.
